Browse All CVEs
13,601 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54225 |
high | 7.5 | 0.0073 | 2026-10-29 | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Pr | |
CVE-2026-57817 |
high | 8.1 | 0.0069 | 2026-10-29 | The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` | |
CVE-2026-57819 |
high | 7.5 | 0.0073 | 2026-10-29 | Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via | |
CVE-2026-64958 |
high | 7.5 | 0.0066 | 2026-10-29 | An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial o | |
CVE-2026-65432 |
high | 7.5 | 0.0065 | 2026-10-29 | Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML | |
CVE-2026-19035 |
high | 7.3 | 0.0318 | 2026-10-29 | A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the f | |
CVE-2026-57818 |
high | 8.1 | 0.0047 | 2026-10-29 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authoriza | |
CVE-2026-68481 |
high | 7.5 | 0.0066 | 2026-10-29 | In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt su | |
CVE-2026-19036 |
high | 7.3 | 0.0318 | 2026-10-29 | A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function | |
CVE-2026-65551 |
high | 7.5 | 0.0039 | 2026-10-29 | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Con | |
CVE-2026-66732 |
high | 8.3 | 0.0017 | 2026-10-29 | Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerab | |
CVE-2026-66733 |
high | 8.7 | 0.0155 | 2026-10-29 | Sonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability | |
CVE-2026-16315 |
high | 8.1 | 0.0042 | 2026-10-29 | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vuln | |
CVE-2026-16731 |
high | 8.3 | 0.0044 | 2026-10-29 | OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vuln | |
CVE-2026-28082 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. | |
CVE-2026-28111 |
high | 8.8 | 0.0042 | 2026-10-29 | Contributor Privilege Escalation in Forminator <= 1.56.0 versions. | |
CVE-2026-28140 |
high | 7.5 | 0.0035 | 2026-10-29 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | |
CVE-2026-28141 |
high | 7.1 | 0.0047 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. | |
CVE-2026-28143 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions. | |
CVE-2026-28172 |
high | 7.1 | 0.0013 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versio | |
CVE-2026-28177 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-34501 |
high | 7.5 | 0.0051 | 2026-10-29 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. | |
CVE-2026-34502 |
high | 7.5 | 0.0051 | 2026-10-29 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached clie | |
CVE-2026-61961 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. | |
CVE-2026-61963 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. | |
CVE-2026-61964 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. | |
CVE-2026-65504 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. | |
CVE-2026-65513 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 ve | |
CVE-2026-65517 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions | |
CVE-2026-65523 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Onl | |
CVE-2026-65541 |
high | 7.3 | 0.0030 | 2026-10-29 | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. | |
CVE-2026-65542 |
high | 8.8 | 0.0050 | 2026-10-29 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |
CVE-2026-65543 |
high | 7.5 | 0.0042 | 2026-10-29 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | |
CVE-2026-65544 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. | |
CVE-2026-65545 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. | |
CVE-2026-65549 |
high | 7.2 | 0.0054 | 2026-10-29 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. | |
CVE-2026-65554 |
high | 7.1 | 0.0034 | 2026-10-29 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. | |
CVE-2026-65559 |
high | 7.2 | 0.0046 | 2026-10-29 | Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions | |
CVE-2026-65560 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions. | |
CVE-2026-65565 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. | |
CVE-2026-65569 |
high | 8.5 | 0.0036 | 2026-10-29 | Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | |
CVE-2026-65570 |
high | 8.1 | 0.0040 | 2026-10-29 | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | |
CVE-2026-66439 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 ver | |
CVE-2026-66440 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 | |
CVE-2026-66457 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-66470 |
high | 7.1 | 0.0032 | 2026-10-29 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. | |
CVE-2026-66663 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | |
CVE-2026-66664 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 version | |
CVE-2026-66690 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | |
CVE-2026-66694 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. |